#!/bin/bash
## Wiregard
WG_ADDR="192.168.100.254/24"
WG_ADDR6="fd22::22/64"
uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key='4OEL9oNlbErbvJRCYmnWzMB+tSJYAfe9Rg+f0CGf3kI='
uci set network.wg0.listen_port='17631'
uci set network.wg0.mtu='1300'
#uci delete network.wg0.addresses
uci add_list network.wg0.addresses="$WG_ADDR"
uci add_list network.wg0.addresses="$WG_ADDR6"
# Add VPN peers
uci add network wireguard_wg0
uci set network.@wireguard_wg0[0].public_key='llWIQUVfKevMYhwzTFAkKy1ETTdAawRKq5CCIToMdBs='
uci set network.@wireguard_wg0[0].preshared_key='9vdujFdkvM6xi/QyllBL7jbUhgmGtHf/eGhjwUYbyUw='
uci set network.@wireguard_wg0[0].route_allowed_ips='1'
#uci delete network.@wireguard_wg0[0].allowed_ips
uci add_list network.@wireguard_wg0[0].allowed_ips="${WG_ADDR%.*}.1/32"
uci add_list network.@wireguard_wg0[0].allowed_ips="${WG_ADDR6%:*}:1/128"
uci add network wireguard_wg0
uci set network.@wireguard_wg0[1].public_key='Xn8+h81fiO3vf8OimEx7hfznoxvwzbAAA7MhlOJpFTY='
uci set network.@wireguard_wg0[1].preshared_key='9vdujFdkvM6xi/QyllBL7jbUhgmGtHf/eGhjwUYbyUw='
uci set network.@wireguard_wg0[1].route_allowed_ips='1'
#uci delete network.@wireguard_wg0[1].allowed_ips
uci add_list network.@wireguard_wg0[1].allowed_ips="${WG_ADDR%.*}.2/32"
uci add_list network.@wireguard_wg0[1].allowed_ips="${WG_ADDR6%:*}:2/128"
uci add network wireguard_wg0
uci set network.@wireguard_wg0[2].public_key='hjYi8kC3BqyZu0edLLrbp3JEz4rMwhaq8IFfJrvf33M='
uci set network.@wireguard_wg0[2].preshared_key='9vdujFdkvM6xi/QyllBL7jbUhgmGtHf/eGhjwUYbyUw='
uci set network.@wireguard_wg0[2].route_allowed_ips='1'
#uci delete network.@wireguard_wg0[2].allowed_ips
uci add_list network.@wireguard_wg0[2].allowed_ips="${WG_ADDR%.*}.3/32"
uci add_list network.@wireguard_wg0[2].allowed_ips="${WG_ADDR6%:*}:3/128"
uci commit network
service network restart

## 修改DHCP，静态IP
LAN_ADDR="$(ifconfig br-lan | grep Bcast | awk '{print $2}' | tr -d "addr:")"
uci add dhcp host
uci set dhcp.@host[-1].name='dsm918'
uci set dhcp.@host[-1].dns='1'
uci set dhcp.@host[-1].mac='00:11:32:c5:09:d5'
uci set dhcp.@host[-1].ip="${LAN_ADDR%.*}.222"
uci set dhcp.@host[-1].leasetime='infinite'
uci add dhcp host
uci set dhcp.@host[-1].name='k2p'
uci set dhcp.@host[-1].mac='68:db:54:5d:28:7b'
uci set dhcp.@host[-1].ip="${LAN_ADDR%.*}.2"
uci set dhcp.@host[-1].leasetime='infinite'
uci add dhcp host
uci set dhcp.@host[-1].name='RT-AC1900P'
uci set dhcp.@host[-1].mac='70:4d:7b:e1:2a:60'
uci set dhcp.@host[-1].ip="${LAN_ADDR%.*}.3"
uci set dhcp.@host[-1].leasetime='infinite'
uci commit dhcp
#/etc/init.d/odhcpd restart

echo '119.28.13.121 www.notion.so' >> /etc/hosts
echo '119.28.13.121 msgstore.www.notion.so' >> /etc/hosts

## Web访问
uci set uhttpd.main.cert='/etc/uhttpd.cer'
uci set uhttpd.main.key='/etc/uhttpd.key'
uci delete uhttpd.main.listen_http
uci delete uhttpd.main.listen_https
uci add_list uhttpd.main.listen_http='0.0.0.0:80'
uci add_list uhttpd.main.listen_http='[::]:8081'
uci add_list uhttpd.main.listen_https='0.0.0.0:443'
uci add_list uhttpd.main.listen_https='[::]:1443'
uci set uhttpd.main.redirect_https='0'
uci commit uhttpd
service uhttpd restart
## SSH
#uci show dropbear
uci add dropbear dropbear
uci set dropbear.@dropbear[-1].PasswordAuth='on'
uci set dropbear.@dropbear[-1].RootPasswordAuth='off'
uci set dropbear.@dropbear[-1].Port='23333'
uci set dropbear.@dropbear[-1].Interface='wan'
uci commit dropbear
/etc/init.d/dropbear restart
#SSH公钥
cat >/etc/dropbear/authorized_keys <<EOF
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCq6k5MA7uEpCUd/MHzLJFQ+rsicLSoF2rtR8vkpNbzaQVudA63zH6lbj7zAl6OD0UdPZlELGILCpOOgWmtRJKB3HcJpN6hC6xr0fUIjLoU6273xjEH/8GgnwcKAaZYBhHMk6s7YcThpuMJ1BnEthhsT/RU7w9W3dsyscy/45Z6LsHjEJ/U3koA7itwyoFXfUil0WeYkUqwtOIRwN2FZKrUXJOUCi585MfhJ6v0qXU92wW1Vb6XevOSsI42Qwg1z4uY2hUtBjtO5XuI6Zh4KTeAL++cmAbaSYmaHTjPY3HSBal4fH8nPTJL/b7ziAo8qjivOKns/5RXwpGa5/UlCm2p iPhone上的快捷指令
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDT139S6AvAbubcto5t45uXJMWQn2tajWTuxX0bxZTm9fR1Q5mPhc0IifaAIZxnxmFX4IXBAPLgWiEzq/pG58blJToBx+Yv3l1yLVFaGaPnI3zoG0PAhpfNbIE/zJC2BZU/L2IKPxtDYk5tQSsfULnjoUI+6t6dv4YViASKhbY1XQ== rMBP
EOF

## 备份配置
cat >>/etc/sysupgrade.conf<<EOF
/etc/uhttpd.cer
/etc/uhttpd.key
/etc/banner
/etc/profile
EOF

## 修改防火墙
uci set firewall.vpn.name='vpn'
uci set firewall.vpn.input='ACCEPT'
uci set firewall.vpn.forward='ACCEPT'
uci set firewall.vpn.output='ACCEPT'
uci set firewall.vpn.masq='1'
uci set firewall.vpn.network='vpn0 wg0'
uci set firewall.vpntowan=forwarding
uci set firewall.vpntowan.src='vpn'
uci set firewall.vpntowan.dest='wan'
uci set firewall.vpntolan=forwarding
uci set firewall.vpntolan.src='vpn'
uci set firewall.vpntolan.dest='lan'
uci set firewall.lantovpn=forwarding
uci set firewall.lantovpn.src='lan'
uci set firewall.lantovpn.dest='vpn'
uci set firewall.opssh=rule
uci set firewall.opssh.name='IPV6-OpenWrt_SSH_WEB'
uci set firewall.opssh.target='ACCEPT'
uci set firewall.opssh.src='wan'
uci set firewall.opssh.family='ipv6'
uci set firewall.opssh.proto='tcp udp'
uci set firewall.opssh.dest_port='23333 8081 1443'
uci set firewall.ssrpserver=rule
uci set firewall.ssrpserver.name='IPV6-OpenWrt_SSR_Server'
uci set firewall.ssrpserver.target='ACCEPT'
uci set firewall.ssrpserver.src='wan'
uci set firewall.ssrpserver.proto='tcp'
uci set firewall.ssrpserver.family='ipv6'
uci set firewall.ssrpserver.dest_port='8388 8389'
uci set firewall.dsm=rule
uci set firewall.dsm.name='DSM'
uci set firewall.dsm.target='ACCEPT'
uci set firewall.dsm.src='wan'
uci set firewall.dsm.dest='lan'
uci set firewall.dsm.family='ipv6'
uci set firewall.dsm.proto='all'
uci set firewall.dsm.dest_port='5000 5001 8083 28083 28096 28983 580 58083'
uci set firewall.dsm.dest_ip='::222/::ffff:ffff:ffff:ffff'
uci set firewall.wireguard=rule
uci set firewall.wireguard.name='wireguard'
uci set firewall.wireguard.target='ACCEPT'
uci set firewall.wireguard.src='wan'
uci set firewall.wireguard.proto='udp'
uci set firewall.wireguard.dest_port='17631'
#uci add firewall rule
#uci set firewall.@rule[-1].target='REJECT'
#uci set firewall.@rule[-1].proto='tcp udp icmp'
#uci set firewall.@rule[-1].src='vpn'
#uci set firewall.@rule[-1].dest='lan'
#uci set firewall.@rule[-1].name='Reject All VPN -> LAN Traffic'
uci commit firewall
#/etc/init.d/firewall reload

uci set fstab.@global[0].anon_mount='0'
uci commit fstab
uci set samba.@samba[0].homes='0'
uci set samba.@samba[0].autoshare='0'
uci commit samba
/etc/init.d/samba restart

## 仅一个客户端NAS获得ipv6
echo 'ip6tables -A input_lan_rule -i br-lan -p ipv6-icmp -m mac ! --mac-source 00:11:32:c5:09:d5 -j DROP' >> /etc/firewall.user
echo 'ip6tables -A input_lan_rule -i br-lan -p udp --dport 547 -m mac ! --mac-source 00:11:32:c5:09:d5 -j DROP' >> /etc/firewall.user
/etc/init.d/firewall reload
# 开启IPV6服务
#2. uci set dhcp.lan.ra_slaac=1  默认
uci delete network.globals.ula_prefix
uci set dhcp.lan.ra='server'
uci set dhcp.lan.dhcpv6='server'
uci set dhcp.lan.ra_management='2'
uci set dhcp.lan.ra_slaac=0
uci commit dhcp
/etc/init.d/odhcpd restart